Exposed services · SonicWall VPN

Is my SonicWall SSL VPN a risk?

It can be.

Last read from the sources at the foot of this page.

Check my firm Read the steps
01

What is a SonicWall SSL VPN?

Date: September 2, 2026 As of September 1, 2026, SonicWall is affected by a vulnerability in the following product: SMA1000

Many small offices use a SonicWall firewall, and its SSL VPN lets staff connect from home. SonicWall's SMA appliances do the same job for larger setups. Both put a sign-in page on the internet.

02

Why does it matter?

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability 2025-02-18 SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

CISA added a SonicOS SSL VPN flaw to its catalog of exploited flaws on 18 February 2025. CISA says it lets a remote attacker bypass authentication.

On 2 September 2026 Canada's Cyber Centre published advisory AV26-872. SonicWall indicates that CVE-2026-83548 and CVE-2026-83549 are being exploited.

03

What do I do about it?

SonicWall indicates that CVE-2026-83548 and CVE-2026-83549 are being exploited.

  1. Install SonicWall's fixed firmware on the firewall or SMA appliance.
  2. Turn on multi-factor sign-in for every VPN account.
  3. Limit the VPN and the admin page to the addresses that need them in your firewall settings.
  4. Turn off the SSL VPN if nobody uses it.
Sources

Where does this come from?

Related
05 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy